Date
June 7, 2025, 10:40 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 21.145495] ================================================================== [ 21.146244] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c4/0x510 [ 21.147171] Read of size 1 at addr fff00000c6540800 by task kunit_try_catch/152 [ 21.148062] [ 21.148405] CPU: 1 UID: 0 PID: 152 Comm: kunit_try_catch Tainted: G B N 6.12.33-rc1 #1 [ 21.148674] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.148784] Hardware name: linux,dummy-virt (DT) [ 21.148870] Call trace: [ 21.148935] dump_backtrace+0x9c/0x128 [ 21.149067] show_stack+0x20/0x38 [ 21.149168] dump_stack_lvl+0x8c/0xd0 [ 21.149308] print_report+0x118/0x5f0 [ 21.149410] kasan_report+0xdc/0x128 [ 21.149515] __asan_report_load1_noabort+0x20/0x30 [ 21.149654] krealloc_uaf+0x4c4/0x510 [ 21.149786] kunit_try_run_case+0x170/0x3f0 [ 21.149884] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.150006] kthread+0x24c/0x2d0 [ 21.150150] ret_from_fork+0x10/0x20 [ 21.150269] [ 21.157656] Allocated by task 152: [ 21.158216] kasan_save_stack+0x3c/0x68 [ 21.158798] kasan_save_track+0x20/0x40 [ 21.160142] kasan_save_alloc_info+0x40/0x58 [ 21.160749] __kasan_kmalloc+0xd4/0xd8 [ 21.161356] __kmalloc_cache_noprof+0x154/0x320 [ 21.161996] krealloc_uaf+0xc8/0x510 [ 21.162537] kunit_try_run_case+0x170/0x3f0 [ 21.163141] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.164023] kthread+0x24c/0x2d0 [ 21.164530] ret_from_fork+0x10/0x20 [ 21.165113] [ 21.165481] Freed by task 152: [ 21.166083] kasan_save_stack+0x3c/0x68 [ 21.166539] kasan_save_track+0x20/0x40 [ 21.166988] kasan_save_free_info+0x4c/0x78 [ 21.167885] __kasan_slab_free+0x6c/0x98 [ 21.168867] kfree+0x110/0x3b8 [ 21.169456] krealloc_uaf+0x130/0x510 [ 21.169912] kunit_try_run_case+0x170/0x3f0 [ 21.170417] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.171144] kthread+0x24c/0x2d0 [ 21.171799] ret_from_fork+0x10/0x20 [ 21.172726] [ 21.173252] The buggy address belongs to the object at fff00000c6540800 [ 21.173252] which belongs to the cache kmalloc-256 of size 256 [ 21.174373] The buggy address is located 0 bytes inside of [ 21.174373] freed 256-byte region [fff00000c6540800, fff00000c6540900) [ 21.175473] [ 21.175768] The buggy address belongs to the physical page: [ 21.176337] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106540 [ 21.177396] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.178244] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 21.178982] page_type: f5(slab) [ 21.179667] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 21.180447] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 21.181224] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 21.182037] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 21.182863] head: 0bfffe0000000001 ffffc1ffc3195001 ffffffffffffffff 0000000000000000 [ 21.183781] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 21.184420] page dumped because: kasan: bad access detected [ 21.185738] [ 21.186006] Memory state around the buggy address: [ 21.186396] fff00000c6540700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.186916] fff00000c6540780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.188651] >fff00000c6540800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.189376] ^ [ 21.189761] fff00000c6540880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.190549] fff00000c6540900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.191814] ================================================================== [ 21.098403] ================================================================== [ 21.099485] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x18c/0x510 [ 21.100509] Read of size 1 at addr fff00000c6540800 by task kunit_try_catch/152 [ 21.101935] [ 21.102284] CPU: 1 UID: 0 PID: 152 Comm: kunit_try_catch Tainted: G B N 6.12.33-rc1 #1 [ 21.102491] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.102568] Hardware name: linux,dummy-virt (DT) [ 21.102655] Call trace: [ 21.102722] dump_backtrace+0x9c/0x128 [ 21.102797] show_stack+0x20/0x38 [ 21.102841] dump_stack_lvl+0x8c/0xd0 [ 21.102888] print_report+0x118/0x5f0 [ 21.102935] kasan_report+0xdc/0x128 [ 21.103008] __kasan_check_byte+0x54/0x70 [ 21.103057] krealloc_noprof+0x48/0x1a0 [ 21.103104] krealloc_uaf+0x18c/0x510 [ 21.103150] kunit_try_run_case+0x170/0x3f0 [ 21.103196] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.103247] kthread+0x24c/0x2d0 [ 21.103292] ret_from_fork+0x10/0x20 [ 21.103339] [ 21.110372] Allocated by task 152: [ 21.110753] kasan_save_stack+0x3c/0x68 [ 21.112160] kasan_save_track+0x20/0x40 [ 21.113042] kasan_save_alloc_info+0x40/0x58 [ 21.113664] __kasan_kmalloc+0xd4/0xd8 [ 21.114194] __kmalloc_cache_noprof+0x154/0x320 [ 21.114771] krealloc_uaf+0xc8/0x510 [ 21.115256] kunit_try_run_case+0x170/0x3f0 [ 21.115752] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.116515] kthread+0x24c/0x2d0 [ 21.117032] ret_from_fork+0x10/0x20 [ 21.117548] [ 21.117891] Freed by task 152: [ 21.118315] kasan_save_stack+0x3c/0x68 [ 21.118877] kasan_save_track+0x20/0x40 [ 21.119422] kasan_save_free_info+0x4c/0x78 [ 21.120394] __kasan_slab_free+0x6c/0x98 [ 21.120992] kfree+0x110/0x3b8 [ 21.121489] krealloc_uaf+0x130/0x510 [ 21.121981] kunit_try_run_case+0x170/0x3f0 [ 21.122523] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.123235] kthread+0x24c/0x2d0 [ 21.123682] ret_from_fork+0x10/0x20 [ 21.124709] [ 21.125089] The buggy address belongs to the object at fff00000c6540800 [ 21.125089] which belongs to the cache kmalloc-256 of size 256 [ 21.126005] The buggy address is located 0 bytes inside of [ 21.126005] freed 256-byte region [fff00000c6540800, fff00000c6540900) [ 21.127151] [ 21.127547] The buggy address belongs to the physical page: [ 21.128312] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106540 [ 21.129357] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.130179] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 21.130955] page_type: f5(slab) [ 21.131339] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 21.132581] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 21.133416] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 21.134261] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 21.135068] head: 0bfffe0000000001 ffffc1ffc3195001 ffffffffffffffff 0000000000000000 [ 21.135950] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 21.137067] page dumped because: kasan: bad access detected [ 21.137814] [ 21.138343] Memory state around the buggy address: [ 21.139026] fff00000c6540700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.140152] fff00000c6540780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.140921] >fff00000c6540800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.141713] ^ [ 21.142173] fff00000c6540880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.142888] fff00000c6540900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.143677] ==================================================================
[ 17.349906] ================================================================== [ 17.351322] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b9/0x5e0 [ 17.351874] Read of size 1 at addr ffff888100396c00 by task kunit_try_catch/169 [ 17.352693] [ 17.352955] CPU: 0 UID: 0 PID: 169 Comm: kunit_try_catch Tainted: G B N 6.12.33-rc1 #1 [ 17.353090] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.353127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.353184] Call Trace: [ 17.353256] <TASK> [ 17.353312] dump_stack_lvl+0x73/0xb0 [ 17.353404] print_report+0xd1/0x640 [ 17.354209] ? __virt_addr_valid+0x1db/0x2d0 [ 17.354310] ? krealloc_uaf+0x1b9/0x5e0 [ 17.354379] ? kasan_complete_mode_report_info+0x64/0x200 [ 17.354489] ? krealloc_uaf+0x1b9/0x5e0 [ 17.354532] kasan_report+0x140/0x180 [ 17.354570] ? krealloc_uaf+0x1b9/0x5e0 [ 17.354602] ? krealloc_uaf+0x1b9/0x5e0 [ 17.354628] __kasan_check_byte+0x3d/0x50 [ 17.354663] krealloc_noprof+0x35/0x140 [ 17.354694] krealloc_uaf+0x1b9/0x5e0 [ 17.354721] ? __pfx_krealloc_uaf+0x10/0x10 [ 17.354746] ? finish_task_switch.isra.0+0x153/0x700 [ 17.354775] ? __switch_to+0x5d9/0xf60 [ 17.354831] ? __schedule+0xc49/0x27a0 [ 17.354954] ? __pfx_read_tsc+0x10/0x10 [ 17.355018] ? ktime_get_ts64+0x84/0x230 [ 17.355059] kunit_try_run_case+0x1a6/0x480 [ 17.355094] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.355122] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 17.355152] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.355188] ? __kthread_parkme+0x82/0x160 [ 17.355243] ? preempt_count_sub+0x50/0x80 [ 17.355286] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.355316] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.355353] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.355389] kthread+0x257/0x310 [ 17.355416] ? __pfx_kthread+0x10/0x10 [ 17.355449] ret_from_fork+0x41/0x80 [ 17.355577] ? __pfx_kthread+0x10/0x10 [ 17.355606] ret_from_fork_asm+0x1a/0x30 [ 17.355650] </TASK> [ 17.355664] [ 17.380302] Allocated by task 169: [ 17.381914] kasan_save_stack+0x45/0x70 [ 17.383100] kasan_save_track+0x18/0x40 [ 17.383517] kasan_save_alloc_info+0x3b/0x50 [ 17.384424] __kasan_kmalloc+0xb7/0xc0 [ 17.385029] __kmalloc_cache_noprof+0x168/0x350 [ 17.385683] krealloc_uaf+0xbc/0x5e0 [ 17.386496] kunit_try_run_case+0x1a6/0x480 [ 17.386821] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.387663] kthread+0x257/0x310 [ 17.388071] ret_from_fork+0x41/0x80 [ 17.388707] ret_from_fork_asm+0x1a/0x30 [ 17.389570] [ 17.389810] Freed by task 169: [ 17.390408] kasan_save_stack+0x45/0x70 [ 17.391341] kasan_save_track+0x18/0x40 [ 17.391781] kasan_save_free_info+0x3f/0x60 [ 17.392202] __kasan_slab_free+0x56/0x70 [ 17.392625] kfree+0x123/0x3d0 [ 17.393826] krealloc_uaf+0x13e/0x5e0 [ 17.394165] kunit_try_run_case+0x1a6/0x480 [ 17.394656] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.395382] kthread+0x257/0x310 [ 17.396010] ret_from_fork+0x41/0x80 [ 17.396353] ret_from_fork_asm+0x1a/0x30 [ 17.397611] [ 17.397783] The buggy address belongs to the object at ffff888100396c00 [ 17.397783] which belongs to the cache kmalloc-256 of size 256 [ 17.399023] The buggy address is located 0 bytes inside of [ 17.399023] freed 256-byte region [ffff888100396c00, ffff888100396d00) [ 17.400660] [ 17.400854] The buggy address belongs to the physical page: [ 17.401179] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100396 [ 17.402339] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.403062] flags: 0x200000000000040(head|node=0|zone=2) [ 17.403704] page_type: f5(slab) [ 17.404979] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.405513] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 17.406591] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.407630] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 17.408249] head: 0200000000000001 ffffea000400e581 ffffffffffffffff 0000000000000000 [ 17.409184] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 17.410170] page dumped because: kasan: bad access detected [ 17.410609] [ 17.411310] Memory state around the buggy address: [ 17.411791] ffff888100396b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.413032] ffff888100396b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.413805] >ffff888100396c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.414415] ^ [ 17.415140] ffff888100396c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.415996] ffff888100396d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.416700] ================================================================== [ 17.418411] ================================================================== [ 17.419860] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53e/0x5e0 [ 17.420916] Read of size 1 at addr ffff888100396c00 by task kunit_try_catch/169 [ 17.422154] [ 17.422354] CPU: 0 UID: 0 PID: 169 Comm: kunit_try_catch Tainted: G B N 6.12.33-rc1 #1 [ 17.422436] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.422472] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.422530] Call Trace: [ 17.422583] <TASK> [ 17.422634] dump_stack_lvl+0x73/0xb0 [ 17.422702] print_report+0xd1/0x640 [ 17.422749] ? __virt_addr_valid+0x1db/0x2d0 [ 17.422825] ? krealloc_uaf+0x53e/0x5e0 [ 17.423081] ? kasan_complete_mode_report_info+0x64/0x200 [ 17.423118] ? krealloc_uaf+0x53e/0x5e0 [ 17.423146] kasan_report+0x140/0x180 [ 17.423182] ? krealloc_uaf+0x53e/0x5e0 [ 17.423261] __asan_report_load1_noabort+0x18/0x20 [ 17.423311] krealloc_uaf+0x53e/0x5e0 [ 17.423340] ? __pfx_krealloc_uaf+0x10/0x10 [ 17.423367] ? finish_task_switch.isra.0+0x153/0x700 [ 17.423400] ? __switch_to+0x5d9/0xf60 [ 17.423435] ? __schedule+0xc49/0x27a0 [ 17.423558] ? __pfx_read_tsc+0x10/0x10 [ 17.423617] ? ktime_get_ts64+0x84/0x230 [ 17.423653] kunit_try_run_case+0x1a6/0x480 [ 17.423687] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.423715] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 17.423742] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.423776] ? __kthread_parkme+0x82/0x160 [ 17.423821] ? preempt_count_sub+0x50/0x80 [ 17.423882] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.423910] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.423946] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.423982] kthread+0x257/0x310 [ 17.424007] ? __pfx_kthread+0x10/0x10 [ 17.424033] ret_from_fork+0x41/0x80 [ 17.424061] ? __pfx_kthread+0x10/0x10 [ 17.424085] ret_from_fork_asm+0x1a/0x30 [ 17.424126] </TASK> [ 17.424139] [ 17.443784] Allocated by task 169: [ 17.444596] kasan_save_stack+0x45/0x70 [ 17.445237] kasan_save_track+0x18/0x40 [ 17.445882] kasan_save_alloc_info+0x3b/0x50 [ 17.446268] __kasan_kmalloc+0xb7/0xc0 [ 17.447243] __kmalloc_cache_noprof+0x168/0x350 [ 17.447628] krealloc_uaf+0xbc/0x5e0 [ 17.448309] kunit_try_run_case+0x1a6/0x480 [ 17.448724] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.449852] kthread+0x257/0x310 [ 17.450398] ret_from_fork+0x41/0x80 [ 17.451185] ret_from_fork_asm+0x1a/0x30 [ 17.451571] [ 17.451793] Freed by task 169: [ 17.452616] kasan_save_stack+0x45/0x70 [ 17.453197] kasan_save_track+0x18/0x40 [ 17.453759] kasan_save_free_info+0x3f/0x60 [ 17.454430] __kasan_slab_free+0x56/0x70 [ 17.455120] kfree+0x123/0x3d0 [ 17.455481] krealloc_uaf+0x13e/0x5e0 [ 17.456229] kunit_try_run_case+0x1a6/0x480 [ 17.456635] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.457755] kthread+0x257/0x310 [ 17.458119] ret_from_fork+0x41/0x80 [ 17.458470] ret_from_fork_asm+0x1a/0x30 [ 17.459518] [ 17.460017] The buggy address belongs to the object at ffff888100396c00 [ 17.460017] which belongs to the cache kmalloc-256 of size 256 [ 17.461400] The buggy address is located 0 bytes inside of [ 17.461400] freed 256-byte region [ffff888100396c00, ffff888100396d00) [ 17.463110] [ 17.463776] The buggy address belongs to the physical page: [ 17.464792] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100396 [ 17.466009] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.466507] flags: 0x200000000000040(head|node=0|zone=2) [ 17.467469] page_type: f5(slab) [ 17.468062] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.468999] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 17.470275] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.470992] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 17.471915] head: 0200000000000001 ffffea000400e581 ffffffffffffffff 0000000000000000 [ 17.473174] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 17.474263] page dumped because: kasan: bad access detected [ 17.474791] [ 17.475409] Memory state around the buggy address: [ 17.476254] ffff888100396b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.476857] ffff888100396b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.477801] >ffff888100396c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.478782] ^ [ 17.479314] ffff888100396c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.480325] ffff888100396d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.481609] ==================================================================